◇ OpenCyber Academy
Technologist · Chapter 18 · English

Chapter 18 — Digital forensics and malware analysis: controls

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Digital forensics and malware analysis: controls

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 From findings to controls"]
  N2["18.2 Controls"]
  N3["18.3 Remediation without evidence loss"]
  N4["18.4 Testing controls"]
  N5["18.5 Change management"]
  N6["18.6 Communication"]
  N7["18.7 Monitoring"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 From findings to controls"]
  N2["18.2 Controls"]
  N3["18.3 Remediation without evidence loss"]
  N4["18.4 Testing controls"]
  N5["18.5 Change management"]
  N6["18.6 Communication"]
  N7["18.7 Monitoring"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 From findings to controls]
    |
    v
[18.2 Controls]
    |
    v
[18.3 Remediation without evidence loss]
    |
    v
[18.4 Testing controls]
    |
    v
[18.5 Change management]
    |
    v
[18.6 Communication]
    |
    v
[18.7 Monitoring]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) propose controls from investigation findings; (2) implement them safely; (3) verify they work; (4) avoid destroying evidence while remediating.

18.1 From findings to controls

Findings: shared local admin passwords; desktop-to-desktop RDP; remote-access malware on PLAN-07; permits export with no anomaly alert; 30-day application log retention.

Each finding is stated as a fact from the investigation, with the evidence behind it. That makes the link to controls explicit: shared local admin passwords allowed one desktop's credentials to work on another; desktop-to-desktop RDP allowed the connection; helper.exe ran on PLAN-07 because nothing limited which programs desktops could start; the export went unnoticed because nothing watched for large exports; short retention nearly lost the export record.

18.2 Controls

Unique managed local admin passwords; host firewall blocking desktop RDP; application allow-listing on desktops; alerts on large permits exports; 12-month central retention.

Each control answers one finding. Unique local passwords stop one guessed password opening many desktops; the host firewall rule removes the path PLAN-07 used to reach CLERK-03; allow-listing would have stopped helper.exe from running from its folder; export alerts would flag a report like the one run under mfoster; longer retention keeps the evidence for later discovery. Jonah lists the pairing in a table so nobody adds controls without a reason.

18.3 Remediation without evidence loss

Before rebuilding PLAN-07 and CLERK-03, Renata confirms images and memory are preserved and verified. Remediation follows only after her sign-off.

Remediation destroys evidence by design: rebuilding a desktop overwrites its disk. Renata's sign-off states which items were collected, that their hashes were verified in the evidence store, and that the external analyst has what they need. Only then may PLAN-07 and CLERK-03 be rebuilt, and the rebuild time is recorded so the timeline shows where investigation ended. Rebuilding before sign-off would be recorded as an error.

18.4 Testing controls

Each control is tested: an RDP attempt between test desktops should fail; a synthetic large export should alert; a test executable outside allowed paths should be blocked.

Each test is designed to fail if the control is missing: a synthetic RDP attempt that succeeds means the rule is not applied, an export that raises no alert means the threshold or forwarding is wrong. Jonah records each test with its date, the expected and actual result and who ran it, and repeats them after any related change.

18.5 Change management

Controls are deployed through change requests with rollback plans.

Each request names the control, the finding it addresses, the systems affected, the test that shows it works and how to undo it. The helpdesk exception for the jump server went through the same process, so the record shows why the rule has a gap. Changes made outside the process during an incident are logged and regularised afterwards. Rollback plans are tested, not just written, so a failed rule can be removed quickly without guessing. Each request also names the person who will confirm the change worked.

18.6 Communication

Staff are told what changed and why, without blaming mfoster, whose session was misused while they were away.

Staff need to know what will feel different, such as remote help now coming only through the jump server, and why. The message explains that a desktop was remotely controlled and a staff account was misused while its owner was away, without naming mfoster. Blame would discourage the early reporting that made this investigation possible. Messages go out before changes take effect, not after.

18.7 Monitoring

New controls produce logs; those logs are forwarded and reviewed.

The firewall rule logs blocked connections, the allow-listing logs blocked programs and the export alert logs each trigger. Forwarding them centrally means the next investigation can see attempts that the controls stopped. Jonah's three-month review used exactly these logs to show the controls were working and to identify the one adjustment staff requested. Without forwarding, the logs of blocked attempts would sit on the desktops and rotate away like the old desktop security logs. Jonah checks monthly that each control's log source is still arriving at the collector.

Measuring effect

Three months after deployment, Jonah reviews logs: zero desktop-to-desktop RDP sessions outside the jump server, two large-export alerts (both legitimate annual reports, confirmed with the permits manager), and four blocked executables, all unwanted software. He reports these figures to the IT manager as evidence the controls work without excessive disruption, and lists one adjustment requested by staff.

Documentation of remediation

Each remediation action is logged with time and operator, so the timeline shows where investigation ended and recovery began.

Worked example

The host firewall rule blocking desktop RDP also blocks the helpdesk's remote support tool. Jonah adds an exception for the helpdesk's jump server only, retests, and records the change. The control now prevents desktop-to-desktop RDP while allowing supported remote help.

Synthetic case. The controls are invented.

Errors and limits

Controls can break legitimate work; test with users and keep rollback ready.

Exercises

Synthesis

Controls should follow from findings, be tested, and never destroy evidence on the way.

Continue studying — chapter 18 of 30

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →